selfhostedops-stack/README.md

~$ selfhostedops-stack

The €15/month self-hosted company stack. Git hosting, wiki, password manager, monitoring, automation and VPN — one server, one compose file, no per-seat pricing.

From the video: Self-Hosted Company Stack for €15/Month (Full Setup) — Series Self-Hosted Company OS, Episode 1.

                        ┌──────────────────────────────────────┐
                        │            caddy  :80/:443           │
                        │      automatic HTTPS for  *.DOMAIN   │
                        └──┬─────┬───────┬───────┬──────┬──────┘
                           │     │       │       │      │
                git.─────► │  wiki.──►   │ status.──►   │
                           │     │       │       │      │
                      ┌────▼─┐ ┌─▼────┐ ┌▼─────┐ ┌▼───┐ ┌▼────┐
                      │forge │ │outline│ │vault │ │kuma│ │ n8n │
                      │  jo  │ │+pg+redis│warden│ │    │ │     │
                      └──────┘ └──────┘ └──────┘ └────┘ └─────┘
                        also: wg-easy (optional, --profile vpn)

Service	URL	Replaces	Typical SaaS price
Forgejo	git.…	GitHub Team	$4/user/mo
Outline	wiki.…	Notion	$10/user/mo
Vaultwarden	vault.…	1Password	$8/user/mo
Uptime Kuma	status.…	Pingdom & co.	$20+/mo
n8n	n8n.…	Zapier	$30+/mo
wg-easy	vpn.…	Tailscale	$6/user/mo

All images are multi-arch (amd64 + arm64) — a €14 ARM cloud box (e.g. Hetzner CAX31) runs the whole thing with room to spare.

Quickstart

# 0. A Debian/Ubuntu server with Docker:
curl -fsSL https://get.docker.com | sh

# 1. DNS: ONE wildcard record  *.ops.example.com -> your server IP (A + AAAA)

# 2. Configure
git clone https://github.com/selfhostedops/selfhostedops-stack.git
cd selfhostedops-stack
cp .env.example .env
nano .env          # domain, email, 3x openssl rand -hex 32

# 3. Launch
docker compose up -d

Ninety seconds later: git. wiki. vault. status. n8n. — all with valid HTTPS.

First-run order (5 minutes)

1. Forgejo (git.…): create the admin account on the setup page. Registration is already disabled via env — this is a company server.
2. Forgejo → SSO for the wiki: Site Administration → Applications → Create OAuth2 app. Redirect URI: https://wiki.<DOMAIN>/auth/oidc.callback. Put the client id/secret into .env, then docker compose up -d outline.
3. Outline (wiki.…): click "Continue with Forgejo". Your git server is your SSO provider — one account, both tools.
4. Vaultwarden (vault.…): create your account, install the Bitwarden apps against https://vault.<DOMAIN>. When the team is on board: VAULTWARDEN_SIGNUPS_ALLOWED=false and re-up.
5. Uptime Kuma (status.…): create admin, add HTTPS monitors for the other five subdomains. Meta, but correct.
6. n8n (n8n.…): create the owner account. This thing becomes the brain of the stack in later episodes (AI agents incoming).

FAQ

Why no Netbird? You said mesh VPN. Full self-hosted Netbird (management plane, signal, TURN, IdP) deserves its own video — that's Episode 5. wg-easy gets you a working WireGuard VPN today with one env var. Skip both if you don't need remote access yet.

Backups? docker compose down, snapshot/borg the named volumes, up -d. A proper 3-2-1 setup (borgmatic + offsite) is Episode 10. Until then: at minimum enable your host provider's snapshot backups.

Can I run only some services? Yes — comment out what you don't need in compose.yml and remove its Caddyfile block. Everything is independent except Outline → Forgejo (SSO) and Outline → its postgres/redis.

Is latest okay for images? For a homelab: pragmatic. For production: pin versions and read HARDENING.md.

Hardening

Before you put real company data on this box, read HARDENING.md. The short version: SSH keys only, firewall (80/443/2222/51820 only), unattended security updates, fail2ban, pinned image tags, offsite backups.

---

MIT — do whatever. If it saved you money, a YouTube subscription is the price: @selfhostedops